Customer data, privacy and AI in banking: what a bank may send to an AI vendor

In the Bank of England and Financial Conduct Authority survey published on 21 November 2024, firms named data protection and privacy as "The largest perceived regulatory constraint to the use of AI" [1]. The survey also found: "Of the top five perceived current risks, four are related to data: data privacy and protection, data quality, data security, and data bias and representativeness" [1].

Many AI uses in a bank need customer data, and the law protects that data. This page covers the rules that apply when customer data goes into an AI system, and what four large AI vendors say about the data they receive. It is part of the guide on AI in banking. Every status is as of 26 October 2026. The rules below are law in force. A bank should confirm with its own counsel how each applies to a given use.

The US information security guidelines

US banking agencies publish Interagency Guidelines Establishing Information Security Standards. The Office of the Comptroller of the Currency (OCC) version is Appendix B to 12 CFR Part 30, and the other agencies' versions carry the same text [2]. They define a service provider broadly: "Service provider means any person or entity that maintains, processes, or otherwise is permitted access to customer information or consumer information through its provision of services directly to the national bank or Federal savings association" [2]. An AI vendor that receives customer data to run a model fits that text, in this guide's reading.

For each service provider, a bank must "Exercise appropriate due diligence in selecting its service providers" [2], require the provider "by contract to implement appropriate measures designed to meet the objectives of these Guidelines" [2], and monitor the provider where the bank's risk assessment calls for it [2]. As part of that monitoring, the bank "should review audits, summaries of test results, or other equivalent evaluations of its service providers" [2]. The bank must also "report to its board or an appropriate committee of the board at least annually" on its information security program [2]. Due diligence means the checks a bank makes on a company before it signs.

Regulation P: sharing with outside companies

Regulation P, at 12 CFR Part 1016, governs when a bank may share nonpublic personal information about a consumer. Its basic rule is that a bank "may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless" it has met the notice and opt-out conditions [3]. A nonaffiliated third party is a company outside the bank's own group. An opt-out lets the consumer refuse the sharing.

There are exceptions, and one of them is for service providers. To use it, a bank must "Enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information" [4]. For an AI vendor, that contract term sets whether the vendor may use the bank's data for anything else, such as training its models. Regulation P has further exceptions in sections 1016.14 and 1016.15, which this guide did not read in full. A bank's counsel should decide which exception, if any, covers a given AI use.

The GDPR and the AI Act in the EU

The General Data Protection Regulation (GDPR) gives a person "the right not to be subject to a decision based solely on automated processing, including profiling" that has legal effects or affects them in a similar way [5]. Article 22(2) allows such decisions when they are needed for a contract, authorised by law, or based on explicit consent [5]. The page AI in credit decisions and fair lending explains how the EU's highest court applied this to credit scores.

Article 35 requires a data protection impact assessment, a written review of the risks of the processing and how to reduce them, before processing that "in particular using new technologies" is "likely to result in a high risk to the rights and freedoms of natural persons" [5]. It is required for "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling" when decisions with legal or similar effects follow [5]. The EU AI Act adds that deployers of high-risk systems "shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment" [6]. Article 13 is the information a provider must give with a high-risk system.

What four AI vendors say about customer data

Each vendor below publishes its own data terms. These are the vendors' own statements, read on 26 October 2026, and vendors can change them. A bank should read the version that applies on the day it signs, and put the terms it relies on into the contract. In the table, a prompt is the text sent to the model, and the response is what it sends back. An API is the service that other software calls directly. Zero data retention (ZDR) means the vendor does not keep prompts or responses after it answers.

Vendor	Training on business customers' data	Retention	Data location
OpenAI (API)	"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)" [7]	Abuse monitoring logs, which can hold prompts and responses, are "retained for up to 30 days" by default, unless law requires longer; zero retention controls need OpenAI's prior approval [7]	With data residency, customer content is stored at rest in the chosen region; eligible models released on or after 5 March 2026 cost 10% more through the residency endpoints, the addresses that keep data in that region [7]
Anthropic	"By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models" [8]	"Under a ZDR arrangement, Anthropic does not store customer prompts or responses at rest after the API response is returned" [9]	Processing requests only in the United States (US-only inference) is offered for Claude 4.6 and later models at 1.1 times the standard rate, and the United States is the only location for stored workspace data [10]
Google Cloud	Google "won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction" [11]	"Google may log prompts to detect potential abuse"; zero data retention needs specific customer actions [11]	Not covered in this guide
Microsoft Azure	Prompts and outputs "are NOT used to train any generative AI foundation models without your permission or instruction" [12]	Not covered in this guide	"Prompts and responses are processed within the customer-specified geography (unless you are using a Global or DataZone deployment type)" [12]

Anthropic says its arrangement must be requested through its sales team and does not cover every feature [9]. Microsoft also says prompts and outputs "are NOT available to OpenAI or other providers of Models sold by Azure" [12]. Google's former data governance page now redirects to a page for its Gemini Enterprise Agent Platform, last updated on 22 October 2026 [11].

The guide page choosing a model provider: terms and data use compares these terms in more detail for a software company. For a bank, each row of the table is a question to settle in the contract, and the AI vendor question list for banks puts them in order.

How banks have deployed generative AI so far

The US Treasury's interviews in late 2023 found that "most interviewed financial firms have not used public access or public application programming interface (API) offerings of Generative AI providers and have instead opted for an enterprise solution deployed in their own virtual cloud network, tenant, or multi-tenant" [13]. An enterprise solution here means a business version of the service, run in the firm's own cloud network or account, or in an account shared with other customers. In the Treasury's December 2024 report, respondents asked regulators to consider "providing additional clarification on standards for data privacy, security, and quality for financial firms developing and deploying AI" [14].

A data map for every AI use

Reveneau's view is that every AI use in a bank needs a data map before it goes live. The map lists every type of customer data the system reads, where it is sent, which vendor holds it and for how long, and which rule allows the sharing.

Step	Question	Rule it answers
1	What customer data does the system read?	Regulation P, GDPR
2	Which vendors receive it, including the vendor's own suppliers?	Information security guidelines [2]
3	Does each contract limit use to the bank's purpose and forbid training?	Regulation P service provider exception [4]
4	How long does each vendor keep it, and where?	Vendor terms [7][8][9][10][11][12]
5	Does any decision about a person rest only on the system?	GDPR Article 22 [5]
6	Is a data protection impact assessment needed?	GDPR Article 35 [5]

The map also needs tests. A system that answers customers or staff from customer records should be tested to show that it never returns one customer's data in a conversation with another. Those tests are evals: written, repeatable checks of the system's answers, run before each release and kept with their dates. The guide on why AI evals matter explains them for a buyer, and the page on access control and least privilege covers who in the bank may see what.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification, the written description of what the software must do. Reveneau says Jev, TypeSafe AI's decision model, grades that suite, and that the suite runs ten times faster than it did with its previous grader. It says it takes responsibility for the whole project through production and after release. To discuss a project, see Reveneau's services or contact Reveneau.